Sort-Object having no effect on Get-EventLog

Question

I'm trying to find the oldest retained Event in the Security Event Log through powershell.

Using the following command: (Get-EventLog Security | Sort-Object -Property Time -Descending)

This returns a list which is not sorted in the least. What am I doing wrong here?

Answer 1

This is not a problem with Get-EventLog, but caused by the fact that the output of Get-EventLog does not have a Porperty Time.

Use Get-Member to show a list of available properties.

Get-EventLog | Get-Member

You'll see, that there is a TimeGenerated property, which you can use.

Get-EventLog Security | Sort-Object -Property TimeGenerated -Descending

Furthermore I'd like to add, that that's the default order anyway. But if you want to switch the order, I recommend using Get-WinEvent instead, which has a -Oldest switch.

Get-WinEvent -LogName Security -Oldest